Bug 2269617 (CVE-2024-26130)

Summary: CVE-2024-26130 python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override
Product: [Other] Security Response Reporter: Robb Gatica <rgatica>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: adudiak, bbuckingham, bcourt, bdettelb, btarraso, caswilli, davidn, dfreiber, drow, ehelms, epacific, gtanzill, hkataria, jburrell, jcammara, jhardy, jmitchel, jneedle, jobarker, jsamir, jsherril, jtanner, kaycoth, kholdawa, kshier, lzap, mabashia, mhulan, mminar, nmoumoul, omaciel, orabin, osapryki, pcreech, psegedy, rbiba, rbobbitt, rchan, sidakwo, simaishi, smcdonal, sskracic, stcannon, sthirugn, teagle, vkrizan, vkumar, yguenane, ytale, zsadeh
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: cryptography 42.0.4 Doc Type: If docs needed, set a value
Doc Text:
A flaw was discovered in python-cryptography. A NULL pointer dereference can be triggered when a PKCS#12 key and certificate do not match. Specifically, if the pkcs12.serialize_key_and_certificates function is called with a non-matching certificate and private key and an encryption algorithm with hmac_hash set, the Python process may crash, leading to a denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2269618, 2269619    
Bug Blocks: 2269615    

Description Robb Gatica 2024-03-14 22:17:05 UTC 
If pkcs12.serialize_key_and_certificates is called with both:
- A certificate whose public key did not match the provided private key
- An encryption_algorithm with hmac_hash set (via PrivateFormat.PKCS12.encryption_builder().hmac_hash(...)

Then a NULL pointer dereference would occur, crashing the Python process. This has been resolved, and now a ValueError is properly raised.

Affected versions: >= 38.0.0, < 42.0.4

Patched in: https://github.com/pyca/cryptography/pull/10423

References:
https://github.com/pyca/cryptography/security/advisories/GHSA-6vqw-3v5j-54x4
https://github.com/pyca/cryptography/pull/10423
https://github.com/pyca/cryptography/commit/97d231672763cdb5959a3b191e692a362f1b9e55
Comment 1 Robb Gatica 2024-03-14 22:24:20 UTC 
Created python-cryptography tracking bugs for this issue:

Affects: fedora-all [bug 2269618]
Comment 9 errata-xmlrpc 2024-06-10 18:37:29 UTC 
This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.4 for RHEL 9
  Red Hat Ansible Automation Platform 2.4 for RHEL 8

Via RHSA-2024:3781 https://access.redhat.com/errata/RHSA-2024:3781